There is no warning. If you set 90 day pin change....
When 90 days passes since the last [pin modified date] in the database for that token, the user enters the old pin one more time [if they did not already change it] (and the old pin will still work this one last time) but they will immediately be faced with and prompted to create a new pin, if in fact that old pin and tokencode was valid. In other words once 90 days passes, the token behaves like it is in new pin mode, and needs to see the old pin one last time to trigger the pin change.
So if you set the policy now and all tokens have pins older than 90 days, those will need an immediate change. If someone set their pin last week, and you now set a 90 day policy, they'll have 83 days to go.
Also
If you make a policy that makes pin strength stronger, all weaker pins need an immediate change on first use, regardless of pin lifetime policy.
If you make a policy that is weaker, no one needs to do a pin change, they just get a chance to make a weaker pin the next time some other action triggers a pin change.
As always if you have concerns on how a system policy change will affect the user population, you can create a security subdomain with your new policies, and just put yourself or a batch of test users in it, and see how the rules affect you or your test users.
